---
title: "world-store-publication — Mova code model"
description: "Mova code model of world/src/store.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/world/src/store.rs.groupant/publication.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/world/src/store.rs.groupant/publication.groupant/>

# world-store-publication

The groupant beside world/src/store.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial source derived instance
- **source:** [`world/src/store.rs`](https://github.com/ElamurAI/mova-free/blob/main/world/src/store.rs)
- **source SHA-256:** `6801677c4f17273e…`
- **covers:** References and single-file replacement (bytes 4302–5074)
- **part of:** [world-store](https://md.groupants.elamur.ai/free/en/mova/world/src/store.rs.groupant/)
- **repository folder:** [`world/src/store.rs.groupant/publication.groupant`](https://github.com/ElamurAI/mova-free/tree/main/world/src/store.rs.groupant/publication.groupant)
- **repository commit:** `48f2e6f74146`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [Forward](#forward) |
| **ast** | partial | `../syntax.json` |
| **cost** | symbolic unmeasured | [Cost](#cost) |
| **descriptant** | present | `model.md` |
| **invariant** | partial | [Invariant](#invariant) |
| **tests** | bounded evidence | `../model.md#tests` |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `nonbehavior` | behavior_complement | partial source derived model | [nonbehavior](#nonbehavior) |
| `antecedents` | reverse_reconstruction | partial source derived model | [antecedents](#antecedents) |
| `rename-failure` | failure_partition | partial source derived model | [rename-failure](#rename-failure) |
| `aliasing` | path_equivalence | partial source derived model | [aliasing](#aliasing) |

## Model text


### descriptant

## Reference publication

### Forward

ref_set creates refs, formats hash plus newline, writes a PID temporary file, then renames it. ref_get reads UTF-8, trims and suppresses empty/error results. Source scopes cover these three functions only.

### Invariant

Successful serialized replacement installs the supplied bytes under the target name. No fsync, unique staging nonce, name confinement, multi-file commit or cleanup-on-error is supplied.

### Cost

O(bytes) writing and reference reading, plus directory and rename filesystem operations. Crash recovery and metadata persistence latency are not measured.

### Epoch memory

2026-10-29: fixed-PID extension replacement aliases distinct filename extensions. Negative observations and preimage fibers must retain old file bytes and whitespace ambiguity. See the parent tests for isolated successful/failed rename evidence.

### catalog

## world-store-publication: typed model catalog

Domain: finite valid byte files, bounded IDs and successful allocation; an operation's arguments plus its initial filesystem and scheduler state are inputs. Observations include returns/errors and written bytes. No simultaneous writer, path traversal, malformed offsets or crash is assumed unless explicitly modeled. Source-derived conditional relation, not a proof of all Rust executions. Evidence: tests.md distinguishes executed probes from proposed oracles.

Every entry is a separate observation/constraint. Status: partial source-derived conditional model. Subject: world/src/store.rs at SHA-256 6801677c4f17273e615090a790f2e4018387ca5d006aab899bafda09f01b24d9. Reverse operators retain all compatible antecedents; complements are candidate inner bounds, not complements of an empirically fitted forward function. Proposed oracles are not executed evidence.

### nonbehavior

Type: behavior_complement.

U is safe-path single-writer calls x returns/file bytes. For source relation R, U minus R contains successful ref_set with final bytes unequal to hash plus newline and ref_get Some(empty). Inner bound under successful normal filesystem operations. Probe checks newline and empty suppression.

### antecedents

Type: reverse_reconstruction.

The fiber of ref_get Some(h) contains every readable UTF-8 byte string whose trim is h, h nonempty; None merges read errors, invalid UTF-8 and whitespace-only content. A successful write does not reconstruct overwritten bytes. Probe distinguishes whitespace, missing and invalid UTF-8.

### rename-failure

Type: failure_partition.

If temporary write succeeds and rename fails, Result is Err, temporary bytes may remain, and target remains whatever the OS left; no cleanup/rollback is implemented. Probe uses a target directory and checks the temp file remains.

### aliasing

Type: path_equivalence.

For fixed PID, with_extension maps a.bin and a.tsv to the same a.tmp-PID. Thus two distinct destination names may share staging storage. Model excludes concurrent writers; path equality oracle checks this collision without racing.